how to upload shell in wordpress

In this article we will share How to upload a shell on WordPress CMS And get a reverse shell target machine, I have setup WordPress Lab on my Localhost Server, if you don’t know how to install WordPress yet CMS an Apache localhost Server Please click the link. Multiple ways to get a reverse shell WordPress Server

Upload to Shell via Add Theme
Shell upload via Add plugin
Topics included in topqa.info
Use the pre-installed Plugins on topqa.info

MsfVenom Payload Cheat Sheet

Reverse Shell Cheat Sheet

List of Termux 2021 commands

Overthewire Bandit . User Manual

Hack Facebook account

First, we login with the WordPress Admin Panel, then we go to the theme options. Read: how to upload shell in wordpresshere we upload our php reverse shell, Click on Upload Theme Button and Browse your reverse shell and click Install Now.After clicking the Install Now button we get an error (Unable to install package. PCLZIP_ERR_BAT_FORMAT (-10), we ignore the error and move on to the next step.In my case my upload folder is hostname/wp-content/uploads/2020/12/shell_name.php, if you use method for different years and months please change it to year or your current month. destination server. let’s start our netcat listener and execute our shell using curl command. There are two ways to execute the shell payload first by navigating the upload directory url and then by using the curl command.Read more: How many worms to feed a hamster The second method is to upload the WordPress reverse shell via the Add New Plugin method, click on the Plugin option and next click on Add New. Now our Plugin option is ready to upload malicious shell on WordPress, click on Upload Plugin and Browser Reverse shell_ and click the Install Now button again.Again we get the same error (Unable to install package.PCLZIP_ERR_BAT_FORMAT (-10) we ignore the error again.Again, we need to start our netcat listener and then we navigate the uploads folder URL in the Browser. Wait a second, we get a reverse shell target machine.Third option is Insert Malicious Code in WordPress Preinstalled Themes, again we login using WordPress Dashboard, but we are not allowed to upload any files and plugins or themes. Theme options and click Theme Editor.Read more: how to fix cracked screen with super glue In my case Activate WordPress theme name was Twenty Twenty go to Themes Files option and click on topqa.info (404 Template) and replace all content with malicious php code and click update file.We’ve started our netcat listener’, navigate to the theme’s uploaded URL and execute a Reverse Shell. If your Activation theme is different, replace the themes folder with the theme name.The last option is to upload Reverse shell on WordPress is Edit currently installed plugins, many times our user privileges are very low, our current login user is not allowed to upload files to WordPress, then we choose this option, This option is an alternative to Themes Editor, Click on Plugins button and next click on Plugin Editor and find any file with .php extension, I choose topqa.info, then Then we replace the existing content with malicious PHP and click Update file.After the plugin file is updated again, we need to start the Netcat Payload Handler and then we execute the reverse shell with the curl command. and the second way is to navigate the edited plugs folder on the browser. Read more: how to chase pigeons in the attic